Micro-service user operation auditing method, device and equipment and storage medium

Abstract

The application discloses a kind of microservice user operation audit method, device, equipment and storage medium, method includes starting operation audit framework, the operation audit framework includes operation audit object, operation audit event and operation audit listener, the logic of operation audit object, the operation audit event and the operation audit listener is expanded by external interface;Start microservice, the operation audit framework is intercepted according to preset filtering mechanism to operation audit object and corresponding operation audit data is collected according to preset application configuration;Based on the operation audit data, the operation audit event is constructed;The operation audit listener receives the operation audit event and processes according to own business logic, and outputs operation audit result.The microservice user operation audit method of the application has good scalability, higher flexibility, can flexibly handle various operation audit requirements, while reducing implementation cost.

Description

Technical Field

[0001] This invention relates to the field of user operation auditing technology, and in particular to a microservice user operation auditing method, apparatus, device, and storage medium. Background Technology

[0002] Microservices are a service-oriented architecture that advocates dividing a monolithic application into a set of small services that coordinate and cooperate with each other to provide end-user value. Each service runs in its own independent process, and services communicate with each other using lightweight communication mechanisms. Each service is built around a specific business function and can be independently deployed to production environments, pre-production environments, etc. After business functions are microservice-ized, the number of service instances explodes, and the corresponding user operations also increase exponentially.

[0003] like Figure 1 As shown, the mainstream methods for operation auditing in the existing technology include multiple operation audit requirements, such as operation audit requirement 1 to operation audit requirement n. Operation audit requirement 1 includes three steps from start to finish: Step S101, the application layer implements operation data collection according to business requirements and determines the code embedding location 1; Step S102, the application layer implements operation data processing according to business requirements, with user operation data processing logic and business logic mixed together; Step S103, the application layer implements operation data output according to business requirements, which cannot be changed after coding. Each operation audit requirement is similar to operation audit requirement 1 from start to finish. For example, operation audit requirement n includes three steps from start to finish: Step SN01, the application layer implements operation data collection according to business requirements and determines the code embedding location n; Step SN02, the application layer implements operation data processing according to business requirements, with user operation data processing logic and business logic mixed together; Step SN03, the application layer implements operation data output according to business requirements, which cannot be changed after coding.

[0004] It is evident that existing operational auditing methods require customized development based on audit needs, with users having to implement data collection, processing, and output themselves. The audit code is coupled with business logic, and once the operational audit logic is determined, it cannot be flexibly changed. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to overcome the defects of existing operation auditing methods, which require customized development according to audit requirements, self-implementation of data collection, processing and output, coupling of audit code and business logic, and inflexibility of operation auditing logic after it is determined. The present invention provides a microservice user operation auditing method, device, equipment and storage medium.

[0006] The present invention solves the above-mentioned technical problems through the following technical solution:

[0007] This invention provides a method for auditing microservice user operations, comprising:

[0008] Start the operation audit framework, which includes operation audit objects, operation audit events, and operation audit listeners. The logic of the operation audit objects, the operation audit events, and the operation audit listeners is extended through external interfaces.

[0009] The microservice is started, and the operation audit framework intercepts the operation audit objects according to the preset filtering mechanism and collects the corresponding operation audit data according to the preset application configuration.

[0010] The operation audit event is constructed based on the operation audit data;

[0011] The operation audit listener receives the operation audit event and processes it according to its own business logic, then outputs the operation audit result.

[0012] In one embodiment, the operation audit framework further includes an operation audit filter;

[0013] The microservice user operation auditing method further includes: using the operation audit filter to embed operation audit points and intercepting the operation audit objects according to the preset filtering mechanism.

[0014] In one embodiment, the operation audit framework further includes an operation audit manager;

[0015] The construction of the operation audit event based on the operation audit data includes:

[0016] The operation audit manager is used to manage the operation audit context, provide operation audit listener registration, collect operation audit data, construct operation audit events based on the operation audit data, and broadcast them.

[0017] In one embodiment, before starting the operation audit framework, the microservice user operation audit method further includes: the application layer starting the operation audit framework through annotations and defining the operation audit object and its corresponding data source.

[0018] In one embodiment, the operation audit data includes request operation audit data and response operation audit data;

[0019] The application layer defines the operation audit object, including:

[0020] The application layer configuration defines the request operation audit data, response operation audit data, and the log output module of the operation audit listener.

[0021] In one embodiment, the operation audit framework intercepts the operation audit object according to a preset filtering mechanism and collects corresponding operation audit data according to a preset application configuration, including:

[0022] The operation audit framework intercepts the request operation audit data according to a preset filtering mechanism and collects the corresponding request operation audit data;

[0023] Execute business logic;

[0024] The operation audit framework intercepts the response operation audit data according to a preset filtering mechanism and collects the corresponding response operation audit data;

[0025] The operation audit manager constructs the operation audit event based on the operation audit data, including: the operation audit manager constructs the operation audit event based on the request operation audit data and the response operation audit data.

[0026] The present invention also provides a microservice user operation auditing device, comprising:

[0027] The operation audit configuration module is used to define operation audit objects and their corresponding data sources in the application layer configuration;

[0028] The operation audit collection module is used to intercept operation audit objects according to a preset filtering mechanism and collect corresponding operation audit data according to a preset application configuration after the microservice starts, and to construct the operation audit event based on the operation audit data;

[0029] The operation audit processing module is used to receive the operation audit events using an operation audit listener, process them according to its own business logic, and output the operation audit results; the operation audit object, the operation audit event, and the logic of the operation audit listener are extended through external interfaces.

[0030] In one embodiment, the operation audit acquisition module includes an operation audit filter and an operation audit manager;

[0031] The operation audit processing module includes an operation audit listener;

[0032] The operation audit filter is used to embed operation audit points and intercept the operation audit objects according to the preset filtering mechanism;

[0033] The operation audit manager is used to manage the operation audit context, provide the operation audit listener registration, collect the operation audit data, construct the operation audit event based on the operation audit data, and broadcast it.

[0034] The operation audit listener is used to receive the operation audit events, process them according to its own business logic, and output the operation audit results.

[0035] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of any of the methods described above.

[0036] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any of the methods described above.

[0037] The microservice user operation auditing method, apparatus, device, and storage medium of the present invention, by starting an operation auditing framework, which includes operation audit objects, operation audit events, and operation audit listeners; starting a microservice, the operation auditing framework intercepts the operation audit objects according to a preset filtering mechanism and collects corresponding operation audit data according to a preset application configuration; constructing operation audit events based on the operation audit data; and receiving the operation audit events and processing them according to its own business logic to output operation audit results. This allows for the independence of user operation data processing logic and business logic. The logic of the operation audit objects, operation audit events, and operation audit listeners is extended through external interfaces. The processing logic of the operation audit objects, operation audit events, and operation event listeners can all be written or configured by the application itself, possessing good scalability and high flexibility. It can flexibly handle various operation auditing needs, ensuring that the operation auditing system meets national and other compliance requirements, meets the needs of business security analysis, and meets the internal compliance auditing requirements of the organization. Simultaneously, it reduces implementation costs and alleviates the burden on development and testing teams. Attached Figure Description

[0038] Figure 1 A flowchart illustrating the mainstream operational auditing methods in existing technologies;

[0039] Figure 2 A flowchart of a microservice user operation auditing method according to an embodiment of the present invention;

[0040] Figure 3 A flowchart of a microservice user operation auditing method according to an embodiment of the present invention;

[0041] Figure 4 This is a schematic diagram of a microservice user operation auditing device according to an embodiment of the present invention;

[0042] Figure 5 This is a schematic diagram of a microservice user operation auditing device according to an embodiment of the present invention. Detailed Implementation

[0043] The present invention will be further illustrated by way of embodiments below, but the present invention is not limited to the scope of the embodiments.

[0044] like Figure 2 As shown, this invention provides a flowchart of a microservice user operation auditing method, which includes the following steps:

[0045] Step S201: Start the operation audit framework. The operation audit framework includes operation audit objects, operation audit events, and operation audit listeners. The logic of operation audit objects, operation audit events, and audit listeners is extended through external interfaces.

[0046] Step S202: Start the microservice. The operation audit framework intercepts the operation audit objects according to the preset filtering mechanism and collects the corresponding operation audit data according to the preset application configuration.

[0047] Step S203: Construct operation audit events based on operation audit data;

[0048] Step S204: The operation audit listener receives operation audit events and processes them according to its own business logic, and outputs the operation audit results.

[0049] This embodiment of the microservice user operation auditing method involves: starting an operation auditing framework, which includes operation audit objects, operation audit events, and operation audit listeners; starting the microservice; the operation auditing framework intercepting operation audit objects according to a preset filtering mechanism and collecting corresponding operation audit data according to preset application configurations; constructing operation audit events based on the operation audit data; and the operation audit listener receiving the operation audit events, processing them according to its own business logic, and outputting operation audit results. This method allows for the independence of user operation data processing logic and business logic. The logic of operation audit objects, operation audit events, and the audit listener is extended through external interfaces. The processing logic of operation audit objects, operation audit events, and operation event listeners can all be written or configured by the application itself, exhibiting good scalability and high flexibility. It can flexibly handle various operation auditing needs, ensuring that the operation auditing system meets national and other compliance requirements, meets the needs of business security analysis, and meets the internal compliance audit requirements of the organization. Simultaneously, it reduces implementation costs and alleviates the burden on development and testing teams.

[0050] In one alternative implementation, the operational audit framework further includes an operational audit filter;

[0051] The microservice user operation auditing method also includes: using operation audit filters to implement operation audit tracking and intercepting operation audit objects according to a preset filtering mechanism. Current mainstream operation auditing methods involve the application layer implementing operation data collection based on business needs, determining the code tracking location, requiring intrusive coding, lacking unified configuration of tracking data, and exhibiting a single audit data output format and incoherent data. This embodiment's microservice user operation auditing method uses operation audit filters to implement operation audit tracking and intercepts operation audit objects according to a preset filtering mechanism. It eliminates the need for microservice coding for tracking, achieves unified configuration of tracking data, allows for configurable audit data output formats, and enables data correlation, improving data collection flexibility and reducing implementation costs.

[0052] In one optional implementation, the operation audit framework further includes an operation audit manager; step S203 includes: using the operation audit manager to manage the operation audit context, providing operation audit listener registration, collecting operation audit data, constructing operation audit events based on the operation audit data, and broadcasting them.

[0053] Existing operational auditing methods typically analyze and extract operational audit data from extended logs, collecting data in a standard format including subject, object, time, and operation type. However, the microservice user operational auditing method in this embodiment abstracts operational audit objects, operational audit events, operational audit listeners, operational audit filters, and operational audit managers to form an operational audit framework, which is an operational audit domain model. This operational audit domain model does not predefine audit objects; operational audit data is directly extracted from the application's runtime process. Specific audit objects and data collection and processing logic are implemented by the application itself. This is a general operational audit framework with good scalability and high flexibility.

[0054] In one optional implementation, before step S201, the microservice user operation auditing method further includes: the application layer starting the operation auditing framework through annotations and defining the operation audit objects and their corresponding data sources. Specifically, the application layer code starts the operation auditing capabilities provided by the operation auditing framework through annotations; the operation audit objects and their corresponding data sources are defined in the application layer configuration, with the default form being the jsonpath path within the HTTP request or response message.

[0055] In one optional implementation, the operation audit data includes request operation audit data and response operation audit data. The application layer defines operation audit objects, including: an application layer configuration module that defines the log output of request operation audit data, response operation audit data, and operation audit listeners. Request and response operation audit data include HTTP request and response operation audit data, as well as MQ request and response operation audit data, and RPC request and response operation audit data. By using the operation audit framework provided by this method, users can reduce the workload of business application development.

[0056] In one optional implementation, step S202 involves the operation audit framework intercepting operation audit objects according to a preset filtering mechanism and collecting corresponding operation audit data according to a preset application configuration. This includes: the operation audit framework intercepting request operation audit data according to the preset filtering mechanism and collecting corresponding request operation audit data; executing business logic; the operation audit framework intercepting response operation audit data according to the preset filtering mechanism and collecting corresponding response operation audit data; and the operation audit manager constructing operation audit events based on the operation audit data. This includes: the operation audit manager constructing operation audit events based on request operation audit data and response operation audit data. This embodiment of the microservice user operation audit method provides a standard implementation of an out-of-the-box operation audit domain model, including HTTP request / response operation audit objects, HTTP access operation audit events, and local log output operation audit event listeners. Microservices do not need to be customized according to audit requirements; they only need to configure the coordinate path of operation audit data in the HTTP request / response message and the log output template to automatically complete the collection, processing, and output of operation audit data, reducing implementation costs and improving audit security.

[0057] The present invention will now be described in further detail:

[0058] like Figure 3 The diagram shows a flowchart of a microservice user operation auditing method according to one embodiment.

[0059] In this embodiment, the microservice user operation auditing method is applied to the microservice operation auditing business of a communication system. It consists of two main parts: operation audit coding / configuration and operation audit execution. The specific steps of the microservice user operation auditing method in this embodiment are as follows:

[0060] Step S301: The application layer code uses an annotation to enable the operation auditing capabilities provided by the operation auditing framework, specifically the annotation @EnablePaasAppAudit. By using the user operation auditing capabilities provided by this method, users can meet the company's requirements for security incident analysis and identify suspicious user operations.

[0061] Step S302: The operation audit framework provides the ability to define and configure audit objects. The application layer configures and defines the HTTP request operation audit object, including the operation audit object type (HTTP request), operation audit object name (user), operation audit object description (username of the user performing the operation), operation audit object value (empty in configuration state, and filled in during runtime), and the JsonPath expression of the data source of the operation audit object ($.order.username).

[0062] Step S303: The operation audit framework provides the ability to define and configure audit objects. The application layer configures and defines the HTTP response operation audit object, including the operation audit object type (HTTP response), operation audit object name (orderNo), operation audit object description (order number generated by the operation), operation audit object value (empty in configuration state, and filled in during runtime), and the JsonPath expression of the operation audit object data source ($.order.orderno).

[0063] Step S304: The application layer configures and defines the log output template of the standard operation audit listener, such as "Operation Audit Log, Operator: {}, Order Number: {}"; Users can use the operation audit capabilities provided by this method to record account activities and retain them for at least 180 days to meet national and other log retention standards.

[0064] Step S305, Microservice startup, start the microservice JVM process;

[0065] Step S306: The operation audit framework intercepts HTTP requests and collects HTTP request operation audit data. The operation audit framework provides a general filter for operation audit instrumentation (no microservice coding instrumentation required). For each HTTP request, the interception logic of this filter will be executed first. Based on the previously defined configuration, the filter uses the operation audit manager object to collect operation audit data from the HTTP request object, generates an instance of the HTTP request operation audit object for this request (automatically collects operation audit data according to the configuration), and stores the data in the operation audit object value attribute of the instance, which is the operation username in this example.

[0066] Step S307: Execute business logic, execute the specific business logic of this request;

[0067] Step S308: The operation audit framework intercepts the HTTP response and collects operation audit data from the HTTP response. Based on the previously defined configuration, the filter uses the operation audit manager object to collect operation audit data from the HTTP response object, generates an instance of the HTTP response operation audit object for this request (operation audit data is automatically collected according to the configuration), and stores the data in the operation audit object value attribute of the instance, which is the operation order number in this example.

[0068] Step S309: The operation audit manager constructs a standard operation audit event (the operation audit framework provides an audit event extension interface, and users can implement the event interface themselves, such as the event record call chain ID, to realize the association of operation audit records). The filter uses the operation audit manager object to construct a standard operation audit event. The standard audit event holds a log output template and a list of operation audit object instances for this request. The standard audit event has a log output method. The logic of this method is to use the operation audit object instances held by this event to populate the log template of this event and then output the operation audit log.

[0069] Step S310: Operation Audit Manager broadcasts an event. The Operation Audit Manager broadcasts an event to all registered operation audit listeners, that is, it calls the listener's onAppAuditEvent callback method.

[0070] Step S311: The standard operation audit event listener processes the event and outputs the operation audit log (the standard audit listener outputs logs; the operation audit framework provides an extended listener interface, and users can implement their own listener interface, such as outputting audit data to a message queue). The business logic is to directly call the event's log output method to output the operation audit log.

[0071] The microservice user operation auditing method in this embodiment defines an operation auditing domain model, including operation auditing objects, operation auditing events, operation auditing listeners, operation auditing filters, and operation auditing managers. It provides a set of standard model implementations, such as HTTP request auditing objects, HTTP response auditing objects, standard auditing events, standard auditing listeners, and standard operation auditing management. It implements operation auditing points based on a filter programming model and provides a set of out-of-the-box operation auditing framework libraries.

[0072] This invention employs a microkernel architecture. The core system handles general functions, while the data source definition and output format for operation auditing can be customized and extended. Specifically, an operation auditing framework constitutes the microkernel architecture. This microkernel is responsible for main process control and context management, and performs operation auditing point embedding based on a filter mechanism. Operation auditing objects, operation auditing events, and operation auditing listeners are exposed through interface specifications, which can be extended as needed by microservice developers according to these specifications. Specifically, it defines the interface specifications for operation auditing objects, which have attributes such as name, description, audit value, and data source coordinates; it defines the interface specifications for operation auditing events, which have attributes such as type, audit value list, and log template, and methods such as audit value setting and audit log output; and it defines the interface specifications for operation auditing listeners, which have audit event handling methods. By adopting a microkernel architecture, the core system handles general functions, while the operation auditing objects, operation auditing events, and operation event listening and processing logic can all be written or configured by the application itself. The system has good scalability and high flexibility. These functions enable flexible handling of various operational auditing needs, ensuring that the system meets national information security compliance requirements, business security analysis needs, and internal compliance auditing requirements.

[0073] This embodiment of the microservice user operation auditing method provides a standard implementation of an out-of-the-box operation auditing domain model, including HTTP request / response operation auditing objects, HTTP access operation auditing events, and local log output operation auditing event listeners. Microservices do not need to be customized according to auditing requirements; they only need to configure the coordinate path of operation auditing data in HTTP request / response messages and log output templates to automatically complete the collection, processing, and output of operation auditing data, reducing implementation costs and improving auditing security.

[0074] like Figure 4 As shown, the present invention provides a microservice user operation auditing device, comprising:

[0075] Operation audit configuration module 1 is used to define operation audit objects and their corresponding data sources in the application layer configuration;

[0076] Operation audit collection module 2 is used to intercept operation audit objects according to a preset filtering mechanism and collect corresponding operation audit data according to the preset application configuration after the microservice starts; and to construct operation audit events based on the operation audit data.

[0077] Operation audit processing module 3 is used to receive operation audit events using the operation audit listener and process them according to its own business logic, and output the operation audit results; the operation audit object, operation audit event, and the logic of the audit listener are extended through external interfaces.

[0078] This embodiment of the microservice user operation auditing device includes an operation audit configuration module 1, which defines operation audit objects and their corresponding data sources in the application layer configuration; an operation audit collection module 2, which intercepts operation audit objects according to a preset filtering mechanism and collects corresponding operation audit data according to a preset application configuration after the microservice starts; and an operation audit event is constructed based on the operation audit data. An operation audit processing module 3 receives operation audit events using an operation audit listener, processes them according to its own business logic, and outputs the operation audit results. The operation audit objects, operation audit events, and the logic of the audit listener are extended through external interfaces, allowing for the independence of user operation data processing logic and business logic. The processing logic of the operation audit objects, operation audit events, and operation event listeners can all be written or configured by the application itself, providing good scalability and high flexibility. It can flexibly handle various operation audit needs, ensuring that the operation audit system meets national and other compliance requirements, meets the needs of business security analysis, and meets the internal compliance audit requirements of the organization. At the same time, it reduces implementation costs and alleviates the burden on development and testing teams.

[0079] In one optional implementation, the microservice user operation auditing device includes an operation audit collection module comprising an operation audit filter and an operation audit manager; an operation audit processing module comprising an operation audit listener; an operation audit filter for performing operation audit data entry and intercepting operation audit objects according to a preset filtering mechanism; an operation audit manager for managing operation audit contexts, providing operation audit listener registration, collecting operation audit data, constructing operation audit events based on the operation audit data, and broadcasting them; and an operation audit listener for receiving operation audit events, processing them according to its own business logic, and outputting operation audit results.

[0080] Current mainstream operation auditing devices rely on the application layer to collect operation data according to business needs, determining code placement for tracking points. This requires intrusive coding, lacks unified configuration of collected tracking points, and suffers from a single output format and incoherent data. The microservice user operation auditing device in this embodiment addresses these issues by using an operation audit filter to collect tracking points and intercepting operation audit objects according to a preset filtering mechanism. It eliminates the need for microservice coding for tracking points, achieves unified configuration of collected tracking points, allows for configurable audit data output formats, and enables data correlation, thus improving data collection flexibility and reducing implementation costs.

[0081] Furthermore, existing operation auditing devices typically analyze and extract operation audit data from extended logs, collecting data in a standard format with subject, object, time, and operation type. In contrast, the microservice user operation auditing device in this embodiment abstracts operation audit objects, operation audit events, operation audit listeners, operation audit filters, and operation audit managers to form an operation audit framework, which is an operation audit domain model. This domain model does not predefine audit objects; operation audit data is directly extracted from the application's runtime process. Specific audit objects and data collection and processing logic are implemented by the application itself. This is a general operation audit framework with good scalability and high flexibility.

[0082] like Figure 5 The diagram shows a module schematic of the microservice user operation auditing device provided by the present invention. The microservice user operation auditing device includes: an operation audit filter, an operation audit manager, an operation audit listener, and operation audit configuration.

[0083] The operation audit filter communicates with the operation audit manager to hold, intercept, and distribute requests and responses. The operation audit configuration communicates with the operation audit manager, which holds and collects operation audit data according to the configuration. The operation audit manager also communicates with the operation audit listener, which is used for operation audit event notification and registering operation audit listeners. The operation audit listener outputs operation audit results to a file system, database, or other storage media.

[0084] The microservice user operation auditing device of the present invention abstracts the operation auditing domain model, including 1) operation auditing object; 2) operation auditing event; 3) operation auditing listener; 4) operation auditing filter; and 5) operation auditing manager.

[0085] The microservice user operation auditing device of this invention is applied to the microservice operation auditing business of a communication system. It consists of two main parts: operation audit coding / configuration and operation audit execution. In this embodiment, the framework refers to the operation audit framework. The specific functions of the microservice user operation auditing device in this embodiment are as follows:

[0086] Operation audit configuration: The application layer code uses annotations to enable the operation audit capabilities provided by the operation audit framework, specifically the annotation @EnablePaasAppAudit.

[0087] This system provides the ability to define and configure audit objects. The application layer configuration defines audit objects for HTTP request operations, including the audit object type (HTTP request), audit object name (user), audit object description (username performing the operation), audit object value (empty in configuration mode, collected and filled in during runtime), and the JSONPath expression for the audit object's data source ($.order.username). It also provides the ability to define and configure audit objects for HTTP response operations, including the audit object type (HTTP response), audit object name (orderNo), audit object description (order number generated by the operation), audit object value (empty in configuration mode, collected and filled in during runtime), and the JSONPath expression for the audit object's data source ($.order.orderno). The application layer configuration defines a standard operation audit listener log output template, such as "Operation Audit Log, Operator: {}, Order Number: {}". By using the user operation audit capabilities provided by this device, users can meet the company's requirements for security incident analysis and identify suspicious user operations. Users can use the operational auditing capabilities provided by this device to record account activities and retain them for at least 180 days, meeting national and other log retention standards.

[0088] After the microservice starts and the microservice JVM process begins, the operation audit framework intercepts HTTP requests and collects HTTP request operation audit data. The operation audit framework provides a general filter for operation audit instrumentation (no microservice coding required). For each HTTP request, the filter's interception logic is executed first. Based on the previously defined configuration, the filter uses the operation audit manager object to collect operation audit data from the HTTP request object, generating an HTTP request operation audit object instance for this request (automatically collecting operation audit data according to the configuration). The data is stored in the instance's operation audit object value attribute; in this example, it's the operation username. Next, the business logic is executed, performing the specific business logic for this request. Finally, the operation audit framework intercepts HTTP responses and collects HTTP response operation audit data. Based on the previously defined configuration, the filter uses the operation audit manager object to collect operation audit data from the HTTP response object, generating an HTTP response operation audit object instance for this request (automatically collecting operation audit data according to the configuration). The data is stored in the instance's operation audit object value attribute; in this example, it's the operation order number.

[0089] The operation audit manager constructs standard operation audit events (the operation audit framework provides an audit event extension interface, and users can implement the event interface themselves, such as the event record call chain ID, to realize the association of operation audit records). The filter uses the operation audit manager object to construct standard operation audit events. The standard audit event holds a log output template and a list of operation audit object instances for this request. The standard audit event has a log output method, the logic of which is to populate the log template of this event with the operation audit object instances held by this event and then output the operation audit log.

[0090] The Operation Audit Manager broadcasts events to all registered Operation Audit Listeners, which means calling the listener's onAppAuditEvent callback method.

[0091] The standard operation audit event listener processes events and outputs operation audit logs (the standard audit listener outputs logs; the operation audit framework provides listener extension interfaces, and users can implement their own listener interfaces, such as outputting audit data to a message queue). The business logic is to directly call the event's log output method to output the operation audit logs.

[0092] The microservice user operation auditing device in this embodiment defines an operation auditing domain model, including operation auditing objects, operation auditing events, operation auditing listeners, operation auditing filters, and operation auditing managers. It provides a set of standard model implementations, such as HTTP request auditing objects, HTTP response auditing objects, standard auditing events, standard auditing listeners, and standard operation auditing management. It implements operation auditing points based on a filter programming model and provides a set of out-of-the-box operation auditing framework libraries.

[0093] This invention employs a microkernel architecture. The core system handles general functions, while the data source definition and output format for operation auditing can be customized and extended. Specifically, an operation auditing framework constitutes the microkernel architecture. This microkernel is responsible for main process control and context management, and performs operation auditing point embedding based on a filter mechanism. Operation auditing objects, operation auditing events, and operation auditing listeners are exposed through interface specifications, which can be extended as needed by microservice developers according to these specifications. Specifically, it defines the interface specifications for operation auditing objects, which have attributes such as name, description, audit value, and data source coordinates; it defines the interface specifications for operation auditing events, which have attributes such as type, audit value list, and log template, and methods such as audit value setting and audit log output; and it defines the interface specifications for operation auditing listeners, which have audit event handling methods. By adopting a microkernel architecture, the core system handles general functions, while the operation auditing objects, operation auditing events, and operation event listening and processing logic can all be written or configured by the application itself. The system has good scalability and high flexibility. These functions enable flexible handling of various operational auditing needs, ensuring that the system meets national information security compliance requirements, business security analysis needs, and internal compliance auditing requirements.

[0094] This embodiment of the microservice user operation auditing device provides a standard implementation of an out-of-the-box operation auditing domain model, including HTTP request / response operation auditing objects, HTTP access operation auditing events, and local log output operation auditing event listeners. Microservices do not need to be customized according to auditing requirements; they only need to configure the coordinate path of operation auditing data in HTTP request / response messages and log output templates to automatically complete the collection, processing, and output of operation auditing data, reducing implementation costs and improving auditing security.

[0095] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described method embodiments.

[0096] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method embodiments.

[0097] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0098] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0099] While specific embodiments of the present invention have been described above, those skilled in the art should understand that these are merely illustrative examples, and the scope of protection of the present invention is defined by the appended claims. Those skilled in the art can make various changes or modifications to these embodiments without departing from the principles and essence of the present invention, but all such changes and modifications fall within the scope of protection of the present invention.

Claims

1. A method for auditing microservice user operations, characterized in that, include: The application layer configuration defines the operation audit object and its corresponding data source, which is in the default form of the jsonpath path in the HTTP request or response message; The operation audit framework is initiated. The operation audit framework includes operation audit objects, operation audit events, and operation audit listeners. The logic of the operation audit objects, the operation audit events, and the operation audit listeners is extended through external interfaces. The operational audit framework also includes an operational audit manager; The microservice is started, and the operation audit framework intercepts the operation audit objects according to the preset filtering mechanism and collects the corresponding operation audit data according to the preset application configuration. The operation audit manager is used to manage the operation audit context, provide the operation audit listener registration, collect the operation audit data, construct the operation audit event based on the operation audit data, and broadcast it. The operation audit listener receives the operation audit event and processes it according to its own business logic, then outputs the operation audit result.

2. The microservice user operation auditing method as described in claim 1, characterized in that, The operational audit framework also includes operational audit filters; The microservice user operation auditing method further includes: using the operation audit filter to embed operation audit points and intercepting the operation audit objects according to the preset filtering mechanism.

3. The microservice user operation auditing method as described in claim 2, characterized in that, Before starting the operation audit framework, the microservice user operation audit method further includes: the application layer starting the operation audit framework through annotations and defining the operation audit object and its corresponding data source.

4. The microservice user operation auditing method as described in claim 3, characterized in that, The operation audit data includes request operation audit data and response operation audit data; The application layer defines the operation audit object, including: The application layer configuration defines the request operation audit data, response operation audit data, and the log output module of the operation audit listener.

5. The microservice user operation auditing method as described in claim 4, characterized in that, The operation audit framework intercepts the operation audit objects according to a preset filtering mechanism and collects corresponding operation audit data according to preset application configurations, including: The operation audit framework intercepts the request operation audit data according to a preset filtering mechanism and collects the corresponding request operation audit data; Execute business logic; The operation audit framework intercepts the response operation audit data according to a preset filtering mechanism and collects the corresponding response operation audit data; The operation audit manager constructs the operation audit event based on the operation audit data, including: the operation audit manager constructs the operation audit event based on the request operation audit data and the response operation audit data.

6. A microservice user operation auditing device, characterized in that, include: The operation audit configuration module is used to define the operation audit objects and their corresponding data sources in the application layer configuration. The default form is the jsonpath path in the HTTP request or response message. The operation audit collection module is used to intercept operation audit objects according to a preset filtering mechanism and collect corresponding operation audit data according to the preset application configuration after the microservice starts. It also includes the operation audit manager; The operation audit manager is used to manage the operation audit context, provide the operation audit listener registration, collect the operation audit data, construct the operation audit event based on the operation audit data, and broadcast it. The operation audit processing module is used to receive the operation audit events using an operation audit listener, process them according to its own business logic, and output the operation audit results; the logic of the operation audit object, the operation audit event, and the operation audit listener is extended through an external interface.

7. The microservice user operation auditing device as described in claim 6, characterized in that, The operation audit acquisition module includes an operation audit filter and an operation audit manager; The operation audit processing module includes an operation audit listener; The operation audit filter is used to embed operation audit points and intercept the operation audit objects according to the preset filtering mechanism; The operation audit manager is used to manage the operation audit context, provide the operation audit listener registration, collect the operation audit data, construct the operation audit event based on the operation audit data, and broadcast it. The operation audit listener is used to receive the operation audit events, process them according to its own business logic, and output the operation audit results.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1-5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-5.

Images